Suspicious ZipExec Execution
ZipExec is a Proof-of-Concept (POC) tool to wrap binary-based tools into a password-protected zip file.
Sigma rule (View on GitHub)
1title: Suspicious ZipExec Execution
2id: 90dcf730-1b71-4ae7-9ffc-6fcf62bd0132
3status: test
4description: ZipExec is a Proof-of-Concept (POC) tool to wrap binary-based tools into a password-protected zip file.
5references:
6 - https://twitter.com/SBousseaden/status/1451237393017839616
7 - https://github.com/Tylous/ZipExec
8author: frack113
9date: 2021-11-07
10modified: 2022-12-25
11tags:
12 - attack.execution
13 - attack.defense-evasion
14 - attack.t1218
15 - attack.t1202
16logsource:
17 category: process_creation
18 product: windows
19detection:
20 run:
21 CommandLine|contains|all:
22 - '/generic:Microsoft_Windows_Shell_ZipFolder:filename='
23 - '.zip'
24 - '/pass:'
25 - '/user:'
26 delete:
27 CommandLine|contains|all:
28 - '/delete'
29 - 'Microsoft_Windows_Shell_ZipFolder:filename='
30 - '.zip'
31 condition: run or delete
32falsepositives:
33 - Unknown
34level: medium
References
Related rules
- Potential Arbitrary File Download Via Cmdl32.EXE
- Potential Binary Impersonating Sysinternals Tools
- Suspicious Child Process Of BgInfo.EXE
- Uncommon Child Process Of BgInfo.EXE
- WSL Child Process Anomaly